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This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

Claims 1-34 (canceled) 

Claim 35 (new): An information processing method for generating a hierarchical 
tree which is applied to processing for supplying cipher texts decryptable only by certain selected 
equipment except excluded (revoked) equipment, by applying a Broadcast Encryption scheme 
based on a hierarchical tree configuration, the information processing method by comprising: 

a one-way tree generating step of generating a one-way tree in which node-corresponding 
values are set to respective nodes, the nodc-corrcsponding values being set such that a node- 
corresponding value NV a corresponding to each of the nodes constituting the hierarchical tree is 
calculable by application of a function f based on a node-corresponding value NVb and a node- 
added variable saltb set so as to correspond to at least one lower-rank node; 

a node key calculating step of calculating node keys NK corresponding to the respective 
nodes constituting the one-way tree, by application of a function He using the node- 
corresponding values NV corresponding to the respective nodes as inputs; and 

an information-for-supply determining step of selecting a minimum node-corresponding 
value and node-added variables required to calculate node-corresponding values included in a 
path from a receiver-corresponding node to a root as a highest-rank node, as information to be 
supplied to a receiver corresponding to a terminal node of the one-way tree. 

Claim 36 (new): The information processing method according to Claim 35, 
wherein: 

the one-way tree generating step generates the one-way tree having a setting in which a 
node-corresponding value for a higher-rank node is calculable by encrypting processing (forward 
computation) to which a Rabin cryptography based on a node-corresponding value for a lower- 
rank node is applied, and in which the node-corresponding value for the lower-rank node is 
calculable by decrypting processing (inverse computation) to which a Rabin cryptography based 
on the node-corresponding value for the higher-rank node is applied. 
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Claim 37 (new): The information processing method according to Claim 35, further 
comprising: 

a cipher text generating step of generating cipher texts by executing encrypting 
processing by selectively applying the node keys set so as to correspond to the respective nodes 
of the hierarchical tree. 

Claim 38 (new): The information processing method according to Claim 35, 
wherein: 

the one-way tree generating step generates the one-way tree in which, in a hierarchical 
tree having a binary tree configuration with a number N of terminal nodes, node-corresponding 
values NV] (1 = 2, 3, — , 2N-1) for respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in the binary tree satisfy a relationship of the following 
expression 

[Math 1] 

N^luij = ( NV i 2 + H ( l II salt ,)) mod M 

where M is a product of two large primes, and H is a mapping function for outputting an 
element of Z M . 

Claim 39 (new): The information processing method according to Claim 38, 
wherein: 

the one-way tree generating step includes, in a hierarchical tree having a binary tree 
configuration with a number N of terminal nodes, using, as inputs, a number of leaves as the 
number of node terminals: N, and a size of a modulus M: |M|, 

a step 1: Determine two large primes of a size |M|/2, and calculate a product M thereof; 

a step 2: Determine the mapping function for outputting an element of Zm: H; 

a step 3: Randomly select a node-corresponding value NVi for a root node being a 
highest-rank node of the binary tree as a value such that NV]gZ*m; 

a step 4: Perform the following processing a, b while incrementing 1 by 1 from 2 to 2N-1 
using 1 as a counter 
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a. Find a minimum positive integer salti such that tmpi is a quadratic residue 
modulo M, in the following expression 

[Math 2] 

temp l = (NV |_ //2 j - H (I \\ salt z )) mod M 

b. Find tmpi 1/2 mod M, and determine any of four solutions as a node- 
corresponding value NV] for a node 1; and 

a step 5: Output 

2N-1 |M|-bit numbers (node-corresponding values): NVi, NV 2 , NV 2 n-i, and 
2N-2 numbers (node-added variables): salt 2 , salt 3 , •-, salt 2 N-i, 

and set them as the node-corresponding values and the node-added variables for the respective 

nodes 1 (1 = 1 through 2N-1) of the binary tree. 

Claim 40 (new): The information processing method according to Claim 35, 
wherein: 

the node key calculating step is a step of calculating node keys NK by application of a 
function He using node-corresponding values NV corresponding to the respective nodes as 
inputs, wherein the function He is a hash function for mapping a node-corresponding value NV 
into data of a bitlength corresponding to a size of a node key. 

Claim 41 (new): The information processing method according to Claim 35, 
wherein: 

the one-way tree generating step generates the one-way tree in which, in a hierarchical 
tree having a binary tree configuration with a number N of terminal nodes, node-corresponding 
values NVi (1 = 2, 3, 2N-1) for respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in the binary tree satisfy a relationship of the following 
expression 

[Math 3] 

NV Ul2 , - (NV ? 0 H salt '(l)) mod M 
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where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salt] times. 

Claim 42 (new): The information processing method according to Claim 41, 
wherein: 

the one-way tree generating step includes, in a hierarchical tree having a binary tree 
configuration with a number N of terminal nodes, using, as inputs, a number of leaves as the 
number of node terminals: N, a size of a modulus M: |M|, and a mapping function H with an |M|- 
bit output, 

a step 1: Determine two large primes of a size |M|/2, and calculate a product M thereof; 

a step 2: Randomly select a node-corresponding value NV] for a root node being a 
highest-rank node of the binary tree as a value such that NV]gZ* m ; 

a step 3: Perform the following processing a, b while incrementing 1 by 1 from 2 to 2N-1 
using 1 as a counter 

a. Find a minimum positive integer salt] such that tmpi is a quadratic residue 
modulo M, in the following expression 

[Math 4] 

temp , = (NV L//2 j 0 H salt 1 (/)) mod M 

b. Find tmp/ 72 mod M, and determine any of four solutions as a node- 
corresponding value NVi for a node 1; and 

a step 4: Output 

2N-1 |M|-bit numbers (node-corresponding values): NVi, NV2, NV2N-1, and 
2N-2 numbers (node-added variables): salt2, salt3, salt2N-i, 

and set them as the node-corresponding values and the node-added variables for the respective 

nodes 1 (1 = 1 through 2N-1) of the binary tree. 

Claim 43 (new): An information processing method for generating a hierarchical 
tree applied to processing for supplying cipher texts decryptable only by certain selected 
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equipment, using a Broadcast Encryption scheme based on a hierarchical tree configuration, the 
information processing method comprising: 

a one-way tree generating step of generating a one-way tree in which node-corresponding 
values are set to respective nodes, the node-corresponding values being set such that a node- 
corresponding value NV a corresponding to each of the nodes constituting the hierarchical tree is 
calculable by application of a function f based on a node-corresponding value NV b and a node- 
added variable salt b set so as to correspond to at least one lower-rank node; 

an intermediate label generating step of generating intermediate labels which are 
intermediate labels (IL) set as values from which values of labels corresponding to some selected 
special subsets, among labels (LABEL) respectively corresponding to subsets set on the basis of 
a SD (Subset Difference) scheme to which the hierarchical tree is applied, are calculable by 
computational processing; 

a label generating step of generating the labels corresponding to the special subsets by 
computational processing based on the intermediate labels, and further generating labels not 
corresponding to the special subsets by a computation based on the generated labels; and 

a labels-for-supply determining step of determining labels for supply to a receiver 
corresponding to a terminal node of the hierarchical tree, and selecting 

the special subset-noncorresponding labels not corresponding to the special 

subsets, and 

a node-corresponding value as a minimum intermediate label and node-added 
variables required to calculate a node-corresponding value for any node included in a path from a 
receiver-corresponding node to a root as a highest-rank node, as information for supply to the 
receiver corresponding to the terminal node of the one-way tree, and 

wherein the one-way tree generating step generates the one-way tree in which, in a 
hierarchical tree having a binary tree configuration with a number N of terminal nodes, node- 
corresponding values NVi (1 = 2, 3, — , 2N-1) for respective nodes 1 to which node numbers 1 are 
given from a higher-rank node of a binary tree in a breadth first order in the binary tree satisfy a 
relationship of the following expression 

[Math 5] 

NV Ul2 I = (NV t 2 0 H saltl (l)) mod M 
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where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salt] times. 

Claim 44 (new): The information processing method according to Claim 43, 
wherein: 

the one-way tree generating step includes, in the hierarchical tree having the binary tree 
configuration with the number N of terminal nodes, using, as inputs, a number of leaves as the 
number of node terminals: N, a size of a modulus M: |M|, and a mapping function H with an |M|- 
bit output, 

a step 1 : Determine two large primes of a size |M|/2, and calculate a product M thereof; 

a step 2: Randomly select a node-corresponding value NV] for the root node being the 
highest-rank node of the binary tree as a value such that NVjeZ m; 

a step 3: Perform the following processing a, b while incrementing 1 by 1 from 2 to 2N-1 
using 1 as a counter 

a. Find a minimum positive integer salt] such that tmpi is a quadratic residue 
modulo M, in the following expression 

[Math 6] 

temp x = (NV Lz/2j 0 H salt 1 (/)) mod M 

b. Find tmpi 1/2 mod M, and determine any of four solutions as a node- 
corresponding value NVi for a node 1; and 

a step 4: Output 

2N-1 |M|-bit numbers (node-corresponding values): NV], NV 2 , — , NV 2 n-i, and 
2N-2 numbers (node-added variables): salt2, salt3, — , salt2N-i, 
and set them as the node-corresponding values and the node-added variables for the 
respective nodes 1 (1 = 1 through 2N-1) of the binary tree. 

Claim 45 (new): A decryption processing method for executing processing for 
decrypting cipher texts encrypted with node keys respectively corresponding to nodes 
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constituting a hierarchical tree, by applying a Broadcast Encryption scheme based on a 
hierarchical tree configuration, the decryption processing comprising: 

a cipher text selecting step of selecting a cipher text to which a node key generable on the 
basis of a node-corresponding value NV and node-added variables salt held by a self apparatus, 
from the cipher texts; 

a node key calculating step of calculating the node key applied to the cipher text on the 
basis of the node-corresponding value NV and the node-added variables salt held by the self 
apparatus; and 

a decrypting step of executing processing for decrypting the cipher text on the basis of 
the calculated node key. 

Claim 46 (new): The decryption processing method according to Claim 45, 
wherein: 

the cipher text selecting step is a step of finding, in a hierarchical tree in which respective 
nodes are given node numbers in a breadth first order with a root as a highest-rank node of the 
hierarchical tree numbered 1, a node number coinciding with any node number included in nodes 
in a path from a receiver to the root, among node numbers for node keys used for encryption. 

Claim 47 (new): The decryption processing method according to Claim 45, 
wherein: 

the node key calculating step includes a step of calculating node-corresponding values in 
a path from a self node to a root being a highest-rank node, among node-corresponding values 
NVi (1 = 2, 3, 2N-1) for respective nodes 1 to which node numbers 1 are given from a higher- 
rank node in a breadth first order in a binary tree, on the basis of the node-corresponding value 
NV and the node-added variables salt held by the self apparatus, by applying the following 
expression 

[Math 7] 

NV lll2] = (NV * + H (/ || salt ,)) mod M 

where M is a product of two large primes, and H is a mapping function for outputting an 
element of Zm- 
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Claim 48 (new): The decryption processing method according to Claim 45, 
wherein: 

the node key calculating step includes a step of calculating on the basis of the node- 
corresponding value held by the self apparatus, or node-corresponding values in a path from a 
self node to a root being a highest-rank node, and further on the basis of the following expression 

NK = He (NV) 

where NK is a node key; NV is a node-corresponding value; and He is a mapping 
function. 

Claim 49 (new): The decryption processing method according to Claim 45, 
wherein: 

the node key calculating step includes a step of calculating node-corresponding values in 
a path from a self node to a root being a highest-rank node, among node-corresponding values 
NVi (1 = 2, 3, -, 2N-1) for respective nodes 1 to which node numbers 1 are given from a higher- 
rank node in a breadth first order in a binary tree, on the basis of the node-corresponding value 
NV and the node-added variables salt held by the self apparatus, by applying the following 
expression 

[Math 8] 

NV [//2j = (NV z 2 © H salt 1 (/)) mod M 

where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salt] times. 

Claim 50 (new): A decryption processing method for executing processing for 
decrypting cipher texts encrypted with subset keys respectively corresponding to subsets set on 
the basis of a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on 
a hierarchical tree configuration, the decryption processing method wherein comprising: 

a cipher text selecting step of selecting a cipher text generated by applying a subset key 
derivable by pseudo-random number generating processing based on a label held by a self 
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apparatus, or a label calculable on the basis of a node-corresponding value NV as an intermediate 
label, and node-added variables salt held by the self apparatus, from the cipher texts; 

a label calculating step of calculating a label corresponding to a special subset by 
executing computational processing based on the node-corresponding value NV and the node- 
added variable salt, if the subset key to be applied to the cipher text is underivable by the 
pseudo-random number generating processing based on the label held; 

a step of generating the subset key by the pseudo-random number generating processing 
based on the label held or the label calculated; and 

a decrypting step of executing processing for decrypting the cipher text by applying the 
generated subset key, and 

wherein the label calculating step includes a step of calculating node-corresponding 
values in a path from a self node to a root being a highest-rank node, among node-corresponding 
values NVi (1 = 2, 3, -, 2N-1) for respective nodes 1 to which node numbers 1 are given from a 
higher-rank node in a breadth first order in a binary tree, on the basis of the node-corresponding 
value NV and the node-added variables salt held by the self apparatus, by applying the following 
expression 

[Math 9] 

NV L//2j = (NV z 2 0 H salt 1 (/)) mod M 

where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salti times. 

Claim 51 (new): An information processing apparatus for generating a hierarchical 
tree which is applied to processing for supplying cipher texts decryptable only by certain selected 
equipment except excluded equipment, by applying a Broadcast Encryption scheme based on a 
hierarchical tree configuration, the information processing apparatus comprising: 

a one-way tree generating means for generating a one-way tree in which node- 
corresponding values are set to respective nodes, the node-corresponding values being set such 
that a node-corresponding value NV a corresponding to each of the nodes constituting the 
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hierarchical tree is calculable by application of a function f based on a node-corresponding value 
NVb and a node-added variable saltb set so as to correspond to at least one lower-rank node; 

a node key calculating means for calculating node keys NK corresponding to the 
respective nodes constituting the one-way tree, by application of a function He using the node- 
corresponding values NV corresponding to the nodes as inputs; and 

an information-for-supply determining means for selecting a minimum node- 
corresponding value and node-added variables required to calculate node-corresponding values 
included in a path from a receiver-corresponding node to a root as a highest-rank node, as 
information to be supplied to a receiver corresponding to a terminal node of the one-way tree. 

Claim 52 (new): The information processing apparatus according to Claim 51, 
wherein: 

the one-way tree generating means is configured to generate the one-way tree having a 
setting in which a node-corresponding value for a higher-rank node is calculable by encrypting 
processing via forward computation to which a Rabin cryptography based on a node- 
corresponding value for a lower-rank node is applied, and in which the node-corresponding value 
for the lower-rank node is calculable by decrypting processing via inverse computation to which 
a Rabin cryptography based on the node-corresponding value for the higher-rank node is applied. 

Claim 53 (new): The information processing apparatus according to Claim 51, 
further comprising: 

a cipher text generating means for generating cipher texts by executing encrypting 
processing by selectively applying the node keys set so as to correspond to the respective nodes 
of the hierarchical tree. 

Claim 54 (new): The information processing apparatus according to Claim 51, 
wherein: 

the one-way tree generating means is configured to generate the one-way tree in which, 
in a hierarchical tree having a binary tree configuration with a number N of terminal nodes, 
node-corresponding values NV] (1 = 2, 3, 2N-1) for respective nodes 1 to which node numbers 
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1 are given from a higher-rank node in a breadth first order in the binary tree satisfy a relationship 
of the following expression 
[Math 10] 

NV lll2] = (NV j 2 + H (I || salt ,)) mod M 

where M is a product of two large primes, and H is a mapping function for outputting an 
element of Z M . 

Claim 55 (new): The information processing apparatus according to Claim 54, 
wherein: 

the one-way tree generating means is configured to execute processing for generating the 
one-way tree by executing, in a hierarchical tree having a binary tree configuration with a 
number N of terminal nodes, using, as inputs, a number of leaves as the number of node 
terminals: N, and a size of a modulus M: |M|, 

a step 1 : Determine two large primes of a size |M|/2, and calculate a product M thereof; 

a step 2: Determine the mapping function for outputting an element of Zm: H; 

a step 3: Randomly select a node-corresponding value NV] for a root node being a 
highest-rank node of the binary tree as a value such that NVieZ* M ; 

a step 4: Perform the following processing a, b while incrementing 1 by 1 from 2 to 2N-1 
using 1 as a counter 

a. Find a minimum positive integer salt] such that tmpi is a quadratic residue 
modulo M, in the following expression 

[Math 11] 

temp x = (NV |_ //2 j - H (I || salt ,)) mod M 

b. Find tmp/ 72 mod M, and determine any of four solutions as a node- 
corresponding value NVi for a node 1; and 

a step 5: Output 

2N-1 |M|-bit numbers (node-corresponding values): NVi, NV 2 , NV 2 n-i, and 
2N-2 numbers (node-added variables): salt2, salt3, salt2N-i, 
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and set them as the node-corresponding values and the node-added variables for the 
respective nodes 1 (1 = 1 through 2N-1) of the binary tree. 

Claim 56 (new): The information processing apparatus according to Claim 51, 
wherein: 

the node key calculating means is configured to calculate node keys NK by application of 
a function He using node-corresponding values NV corresponding to the respective nodes as 
inputs, wherein the function He is a hash function for mapping a node-corresponding value NV 
into data of a bitlength corresponding to a size of a node key. 

Claim 57 (new): The information processing apparatus according to Claim 51, 
wherein: 

the one-way tree generating means is configured to generate the one-way tree in which, 
in a hierarchical tree having a binary tree configuration with a number N of terminal nodes, 
node-corresponding values NVi (1 = 2, 3, — , 2N-1) for respective nodes 1 to which node numbers 
1 are given from a higher-rank node in a breadth first order in the binary tree satisfy a relationship 
of the following expression 

[Math 12] 

NV L//2j = (NV t 2 0 H salt 1 (/)) mod M 

where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salt] times. 

Claim 58 (new): The information processing apparatus according to Claim 57, 
wherein: 

the one-way tree generating means is configured to generate the one-way tree by 
executing, in a hierarchical tree having a binary tree configuration with a number N of terminal 
nodes, using, as inputs, a number of leaves as the number of node terminals: N, a size of a 
modulus M: |M|, and a mapping function H with an |M|-bit output, 

a step 1 : Determine two large primes of a size |M|/2, and calculate a product M thereof; 
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a step 2: Randomly select a node-corresponding value NVi for a root node being a 
highest-rank node of the binary tree as a value such that NVieZ m; 

a step 3: Perform the following processing a, b while incrementing 1 by 1 from 2 to 2N-1 
using 1 as a counter 

a. Find a minimum positive integer salti such that tmpi is a quadratic residue 
modulo M, in the following expression 

[Math 13] 

temp l = (NV L//2 j 0 H salt 1 (/)) mod M 

b. Find tmpi 1/2 mod M, and determine any of four solutions as a node- 
corresponding value NVi for a node 1; and 

a step 4: Output 

2N-1 |M|-bit numbers (node-corresponding values): NVi, NV 2 , NV2N-1, and 
2N-2 numbers (node-added variables): salt2, salt 3 , salt2N-i> 
and set them as the node-corresponding values and the node-added variables for the 
respective nodes 1 (1 = 1 through 2N-1) of the binary tree. 

Claim 59 (new): An information processing apparatus for generating a hierarchical 
tree applied to processing for supplying cipher texts decryptable only by certain selected 
equipment, using a Broadcast Encryption scheme based on a hierarchical tree configuration, the 
information processing apparatus comprising: 

a one-way tree generating means for generating a one-way tree in which node- 
corresponding values are set to respective nodes, the node-corresponding values being set such 
that a node-corresponding value NV a corresponding to each of the nodes constituting the 
hierarchical tree is calculable by application of a function f based on a node-corresponding value 
NVb and a node-added variable saltb set so as to correspond to at least one lower-rank node; 

an intermediate label generating means for generating intermediate labels which are 
intermediate labels (IL) set as values from which values of labels corresponding to some selected 
special subsets, among labels (LABEL) respectively corresponding to subsets set on the basis of 
a SD (Subset Difference) scheme to which the hierarchical tree is applied, are calculable by 
computational processing; 
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a label generating means for generating the labels corresponding to the special subsets by 
computational processing based on the intermediate labels, and further generating labels not 
corresponding to the special subsets by a computation based on the generated labels; and 

a labels-for-supply determining means for determining labels for supply to a receiver 
corresponding to a terminal node of the hierarchical tree, and selecting 

the special subset-noncorresponding labels not corresponding to the special 

subsets, and 

a node-corresponding value as a minimum intermediate label and node-added 
variables required to calculate a node-corresponding value for any node included in a path from a 
receiver-corresponding node to a root as a highest-rank node, as information for supply to the 
receiver corresponding to the terminal node of the one-way tree, and 

wherein the one-way tree generating means is configured to generate the one-way tree, in 
which in a hierarchical tree having a binary tree configuration with a number N of terminal 
nodes, node-corresponding values NV\ (1 = 2, 3, — , 2N-1) for respective nodes 1 to which node 
numbers 1 are given from a higher-rank node of a binary tree in a breadth first order in the binary 
tree satisfy a relationship of the following expression 

[Math 14] 

NV L//2 j = (NV * 0 H salt 1 (/)) mod M 

where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salt] times. 

Claim 60 (new): The information processing apparatus according to Claim 59, 
wherein: 

the one-way tree generating means is configured to generate the one-way tree by 
executing, in the hierarchical tree having the binary tree configuration with the number N of 
terminal nodes, using, as inputs, a number of leaves as the number of node terminals: N, a size of 
a modulus M: |M|, and a mapping function H with an |M|-bit output, 

a step 1 : Determine two large primes of a size |M|/2, and calculate a product M thereof; 
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a step 2: Randomly select a node-corresponding value NVi for the root node being the 
highest-rank node of the binary tree as a value such that NVieZ* M ; 

a step 3: Perform the following processing a, b while incrementing 1 by 1 from 2 to 2N-1 
using 1 as a counter 

a. Find a minimum positive integer salti such that tmpi is a quadratic residue 
modulo M, in the following expression 

[Math 15] 

temp z = (NV L//2 j 0 H salt 1 (/)) mod M 

b. Find tmpi 1/2 mod M, and determine any of four solutions as a node- 
corresponding value NVi for a node 1; and 

a step 4: Output 

2N-1 |M|-bit numbers (node-corresponding values): NVi, NV 2 , -, NV 2 n-i, and 
2N-2 numbers (node-added variables): salt2, salt 3 , salt 2 N-i, 
and set them as the node-corresponding values and the node-added variables for the 
respective nodes 1 (1 = 1 through 2N-1) of the binary tree. 

Claim 61 (new): A decryption processing apparatus for executing processing for 
decrypting cipher texts encrypted with node keys respectively corresponding to nodes 
constituting a hierarchical tree, by applying a Broadcast Encryption scheme based on a 
hierarchical tree configuration, the decryption processing apparatus comprising: 

a cipher text selecting means for selecting a cipher text to which a node key generable on 
the basis of node-corresponding values NV and node-added variables salt held by a self 
apparatus, from the cipher texts; 

a node key calculating means for calculating the node key applied to the cipher text on 
the basis of the node-corresponding value NV and the node-added variables salt held by the self 
apparatus; and 

a decrypting means for executing processing for decrypting the cipher text on the basis of 
the calculated node key. 
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Claim 62 (new): The decryption processing apparatus according to Claim 61, 
wherein: 

the cipher text selecting means is configured to find, in a hierarchical tree in which 
respective nodes are given node numbers in a breadth first order with a root as a highest-rank 
node of the hierarchical tree numbered 1, a node number coinciding with any node number 
included in nodes in a path from a receiver to the root, among node numbers for node keys used 
for encryption. 

Claim 63 (new): The decryption processing apparatus according to Claim 61 
wherein: 

the node key calculating means 

is configured to execute processing for calculating 

node-corresponding values in a path from a self node to a root being a highest-rank node, 
among node-corresponding values NV] (1 = 2, 3, — , 2N-1) for respective nodes 1 to which node 
numbers 1 are given from a higher-rank node in a breadth first order in a binary tree, on the basis 
of the node-corresponding value NV and the node-added variables salt held by the self apparatus, 
by applying the following expression 

[Math 16] 

M r lU2j = (NV t 2 + H (/ || salt ,)) mod M 

where M is a product of two large primes, and H is a mapping function for outputting an 
element of Zm- 

Claim 64 (new): The decryption processing apparatus according to Claim 61, 
wherein: 

the node key calculating means 

is configured to execute processing for calculating on the basis of the node-corresponding 
value held by the self apparatus, or node-corresponding values in a path from a self node to a 
root being a highest-rank node, and further on the basis of the following expression 

NK = He (NV) 
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where NK is a node key; NV is a node-corresponding value; and He is a mapping 
function. 

Claim 65 (new): The decryption processing apparatus according to Claim 45, 
characterized in that: 

the node key calculating means is configured to execute processing for calculating node- 
corresponding values in a path from a self node to a root being a highest-rank node, among node- 
corresponding values NV] (1 = 2, 3, 2N-1) for respective nodes 1 to which node numbers 1 are 
given from a higher-rank node in a breadth first order in a binary tree, on the basis of the node- 
corresponding value NV and the node-added variables salt held by the self apparatus, by 
applying the following expression 

[Math 17] 

NV lll2] = (NV j 2 0 H saltl (l)) mod M 

where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salt] times. 

Claim 66 (new): A decryption processing apparatus for executing processing for 
decrypting cipher texts encrypted with subset keys respectively corresponding to subsets set on 
the basis of a SD (Subset Difference) scheme which is a Broadcast Encryption scheme based on 
a hierarchical tree configuration, the decryption processing apparatus comprising: 

a cipher text selecting means for selecting a cipher text generated by applying a subset 
key derivable by pseudo-random number generating processing based on a label held by a self 
apparatus, or a label calculable on the basis of a node-corresponding value NV as an intermediate 
label, and node-added variables salt held by the self apparatus, from the cipher texts; 

a label calculating means for calculating a label corresponding to a special subset by 
executing computational processing based on the node-corresponding value NV and the node- 
added variables salt, if the subset key to be applied to the cipher text is underivable by the 
pseudo-random number generating processing based on the label held; 
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a means for generating the subset key by the pseudo-random number generating 
processing based on the label held or the label calculated; and 

a decrypting means for executing processing for decrypting the cipher text by applying 
the generated subset key, and 

wherein the label calculating means is configured to execute processing for calculating 
node-corresponding values in a path from a self node to a root being a highest-rank node, among 
node-corresponding values NV] (1 = 2, 3, -, 2N-1) for respective nodes 1 to which node numbers 
1 are given from a higher-rank node in a breadth first order in a binary tree, on the basis of the 
node-corresponding value NV and the node-added variables salt held by the self apparatus, by 
applying the following expression 

[Math 18] 

NV lui J = (NV , 2 ® H salt 1 (/)) mod M 

where H is a function for mapping an input of any size into a size |M| of a product M of 
the said two large primes, and H saltl (1) represents a value obtained by applying the function H to 1 
as many as salt] times. 

Claim 67 (new): A computer program for generating a hierarchical tree which is 
applied to processing for supplying cipher texts decryptable only by certain selected equipment 
except excluded equipment, by applying a Broadcast Encryption scheme based on a hierarchical 
tree configuration, the computer program comprising: 

a one-way tree generating step of generating a one-way tree in which node-corresponding 
values are set to respective nodes, the node-corresponding values being set such that a node- 
corresponding value NV a corresponding to each of the nodes constituting the hierarchical tree is 
calculable by application of a function f based on a node-corresponding value NVb and a node- 
added variable saltb set so as to correspond to at least one lower-rank node; 

a node key calculating step of calculating node keys NK corresponding to the respective 
nodes constituting the one-way tree, by application of a function He using the node- 
corresponding values NV corresponding to the respective nodes as inputs; and 

an information-for-supply determining step of selecting a minimum node-corresponding 
value and node-added variables required to calculate node-corresponding values included in a 
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path from a receiver-corresponding node to a root as a highest-rank node, as information to be 
supplied to a receiver corresponding to a terminal node of the one-way tree. 

Claim 68 (new): A computer program for executing processing for decrypting 
cipher texts encrypted with node keys respectively corresponding to nodes constituting a 
hierarchical tree, by applying a Broadcast Encryption scheme based on a hierarchical tree 
configuration, the computer program comprising: 

a cipher text selecting step of selecting a cipher text to which a node key generable on the 
basis of node-corresponding values NV and node-added variables salt held by a self apparatus, 
from the cipher texts; 

a node key calculating step of calculating a node key applied to the cipher text on the 
basis of the node-corresponding values NV and node-added variables salt held by the self 
apparatus; and 

a decrypting step of executing processing for decrypting the cipher text on the basis of 
the calculated node key. 
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